It is known that an automatic landing system of this kind is aimed at controlling the descent path of an airplane so as to make the latter touch down on a runway and, more especially, inside an area of the runway called the little runway.
Such control is carried out using ILS-type radio navigation signals (glide and lock), picked up by radio or radio navigation measurement probes on board the airplane.
It is known that the path followed by an airplane while landing includes two phases, namely a first phase of descent on a fictitious axis of the runway (during which the airplane is guided longitudinally and transversely by ILS radio navigation signals) and a second so-called flare phase (during which the airplane is made to describe a curved path linking up with the runway, so as to reduce the velocity of impact of the airplane on the runway). This makes it possible to improve landing comfort and to avoid any damage to the structure of the airplane, especially to its landing gear.
It thus seems natural to control this path by knowing the height of the wheels of the landing gear of the airplane with respect to the ground.
A simple geometrical correction enables this height to be determined from the distance separating the altimetric probes from the lower part of the wheels of the airplane.
Several devices for estimating the altitude of an aircraft, in particular with a view to controlling its landing path, are already known for this purpose.
For example, BOEING airplanes include a device of this kind comprising three radio altimeters whose outputs are connected respectively to the inputs of a poller, the output of this poller delivering a signal representing the estimation of the altitude. In such a device, when the three radio altimeters are working properly, the three altitude measurements are very close to one another and, when fault-free, the polled measurement differs very little from each of the three measurements of the radio altimeters.
In the event that one of the radio altimeters is faulty, it delivers an incorrect measurement. By contrast, when free of any other fault, the measurements arising from the other two radio altimeters are virtually identical, and the polled measurement is, thus virtually identical to these latter two measurements.
The known device described above does not therefore notice the first fault of a radio altimeter, and it is said to be "passive". That is to say it exhibits good transparency in relation to a fault in any one of the radio altimeters.
However, this known device has a significant disadvantage, since it requires three independent measurement chains.
In order to remedy this disadvantage, other devices have been proposed, such as those equipping the AIRBUS airplanes.
These devices include two radio altimeters, one of which is the main and the other of which is the standby radio altimeter.
A switch makes it possible to connect up to the output of the standby radio altimeter, in the event of a recognized fault in the main radio altimeter.
Such a device has the advantage of requiring just two radio altimeters.
However, it has a number of disadvantages. It is passive in respect of a fault only after recognition of the fault and switching over to the other radio altimeter. Moreover, if the standby radio altimeter is also defective, the ability to land on automatic is lost.
In order to try to remedy these disadvantages, it has been proposed to apply the output from one or the other of the radio altimeters to the terminals of the switch across auxiliary switches.
However, this solution also requires knowledge of the faults.